v0.4.0 — Security Hardening

v0.4.0 — Security Hardening

Full remediation of all HIGH and MEDIUM findings from the March 2026 security audit. All 62 ACVP test vectors pass across both C++ and Rust WASM engines (31 per engine, zero failures, zero skips).

Security fixes

Severity	Count	Status
Critical	3	✅ Fixed in prior releases
High	10	✅ All fixed
Medium	14	✅ All fixed
Low / Info	10	Accepted / architectural

HIGH fixes:

• RSA X.509 integer underflow guard (ulDataLen > size → CKR_DATA_LEN_RANGE)
• AES-CBC IV length enforcement (exactly 16 bytes, not just non-NULL)
• WrapKeySym/UnwrapKeySym mode variable left unset for AES-CBC/CBC-PAD
• pValue NULL dereference on required object creation attributes

MEDIUM fixes:

• GcmMsgCtx param zeroization before free() in Session::resetOp
• File::readString 64 MiB OOM cap
• Path traversal + symlink rejection in Directory::refresh
• ML-KEM shared secret and stored value wiped after encapsulate/decapsulate
• RSA-PSS salt length bounded to 512 bytes at all 20 PSS parameter sites
• HandleManager counter seeded with random 20-bit offset (non-predictable handles)
• CKM_SLH_DSA pure mode: reject non-NULL pParameter
• Rust NULL output pointer guards in 6 FFI entry points
• HMAC constant-time comparison via subtle::ConstantTimeEq
• KMAC constant-time comparison via subtle::ConstantTimeEq
• SymDecryptUpdate integer overflow guard
• IV ByteString zeroization on all error paths in OSSLEVPSymmetricAlgorithm

Build / supply chain:

• Default CMake build type → Release
• package-lock.json committed
• Optional GPG verification for OpenSSL source
• cargo audit CI job
• -fstack-protector-strong + Linux relro/now/noexecstack flags
• WASM maximum memory 512 MiB

ACVP validation — 62/62 PASS

Both C++ and Rust engines tested in dual mode:

Algorithm	Engine	Result
AES-GCM-256 Decrypt KAT	C++ + Rust	✅ PASS
AES-CBC-256 Decrypt KAT	C++ + Rust	✅ PASS
AES-CTR-256 Decrypt KAT	C++ + Rust	✅ PASS
AES-KW-256 Wrap KAT	C++ + Rust	✅ PASS
AES-KWP-256 Wrap+Unwrap RT	C++ + Rust	✅ PASS
HMAC-SHA256/384/512 Verify KAT	C++ + Rust	✅ PASS (×3)
SHA-256 Digest KAT (3 vectors)	C++ + Rust	✅ PASS (×3)
RSA-PSS-2048 SigVer KAT	C++ + Rust	✅ PASS
ECDSA P-256 SigVer KAT	C++ + Rust	✅ PASS
ECDSA P-384 SigVer KAT	C++ + Rust	✅ PASS
EdDSA Ed25519 Functional	C++ + Rust	✅ PASS
ML-DSA-44/65/87 SigVer KAT	C++ + Rust	✅ PASS (×3)
ML-DSA-44/65/87 Functional	C++ + Rust	✅ PASS (×3)
ML-KEM-512/768/1024 Decap KAT	C++ + Rust	✅ PASS (×3)
ML-KEM-512/768/1024 RT	C++ + Rust	✅ PASS (×3)
SLH-DSA-SHA2-128s Functional	C++ + Rust	✅ PASS
SLH-DSA-SHAKE-256f Functional	C++ + Rust	✅ PASS
PBKDF2-HMAC-SHA512 Derivation	C++ + Rust	✅ PASS
HKDF-SHA256 Derivation	C++ + Rust	✅ PASS

Full security audit report attached below.